1. Field of the Invention
The present invention relates to a method and management agent for event notifications correlation.
2. Description of the Related Art
A large telecommunication management network includes various types of Network Resources (NRs). NRs may include communications nodes that insure the service provision to network subscribers, such as for example in the case of a cellular telecommunications network. Such a network may include nodes like Mobile Switching Centers (MSCs), Base Station Controllers (BSCs), Base Stations (BSs), Packet Data Service Nodes (PDSNs), Home Location Registers (HLRs), Home Agents (HAs) and the like, which are viewed as NRs from the perspective of the telecommunication management network. The later exercises supervision, monitoring, and control on its NRs. Within the management network, the NRs are represented by a set of software objects called Management Objects (MOs), which are maintained using various network management applications.
The use of software objects (i.e. of the MO instances) to represent the NRs for large networks management is a key characteristics of modern network management paradigms such as those advanced by the Telecommunication management network (TMN) of the International Telecommunication Union-Telecommunication Standardization Sector (ITU-T) and by the 3rd Generation Partnership Project (3GPP) Integration Reference Point framework for 3G wireless networks.
In a large telecommunication management network, there is a distinction between one type of application called manager and another type of application called agent. In general, the agent manages the NRs on behalf of managers, i.e. the managers do not directly interact with the NRs. Rather, the managers control the NRs by sending instructions to agents, that in turns control the NRs. In such a context, the agent typically has a Management Information Base (MIB), called agent-MIB, which is a collection of MOs (including their attributes) representing all NRs under management of that agent. Each manager also has a MIB, called manager-MIS that holds this particular manager's perspective or knowledge about the NRs under its management in the form of MOs as well.
Accordingly, the principle that in large telecommunication networks the manager does not interact directly with the NRs, but rather with one or more agents linked to a set of NRs is widely used and well documented in the telecommunications industry.
One key element of the modem telecommunication network management is for agents to report and for managers to timely receive network event notifications (also called herein notifications or alarm notifications), such as occurrences of NR state changes and NR alarms. Reception of network events by managers allow managers to have the current view of the state of affairs of the network so that they can perform analysis, such as network alarm root cause identification, network traffic trends, etc.
The way managers receive the network events is typically as follows. One agent is responsible for the management of a group of NRs. Each agent is responsible to report state changes of its managed NRs in a form of event notifications and maintains a notification log and an Active Alarm List (AAL). The log tracks all notifications that are emitted toward the manager, while the ML tracks all notifications carrying active alarm information received from NRs. Active alarm notifications are defined as alarm notifications that are not yet cleared and not yet acknowledged by the manager. The manager can pull/read the contents of the log and of the ML whenever it needs. Each agent may send notifications of its managed NRs to multiple managers.
In prior art implementations, agents emit notifications to report NR state changes solely to their corresponding managers. Agents do not report these notifications to other peer agents. Network state changes reported in these notifications may be caused by a certain event of a network node (e.g. a software module of a network node has restarted) or network link (e.g. cable is cut). More importantly, the occurrence of an event of a network node or network link normally affects multiple NR states.
Since each agent is reporting its own notifications to its corresponding manager and not to its peer agents, the notifications of various agents are never correlated at the agents level, i.e. the information contained in one notification from one agent cannot indicate that it is related to another notification of another agent, even if the notifications are caused by the same network event. As a consequence, the manager has to process received notifications from various agents and perform notification correlation, which is a resource-consuming task.
Thus, today's state-of-the-art solutions put a heavy burden in terms of processing activity on the managers, because notifications received from an agent cannot be correlated with notifications from another agent before they are received in the manager. This leads to unnecessary signalling load between the agents and the manager, such as for example when multiple notifications related to the same cause are sent to the manager from multiple agents. This leads to unnecessary processing execution at the manager that may result in an overload or even a failure for the later, thus creating a hazardous situation, since in a given network, the role of a manager is critical.
Although there is no prior art solution as the one proposed hereinafter for solving the above-mentioned deficiencies, the U.S. Pat. No. 6,000,045 issued to Lewis (hereinafter called Lewis) bears some relation with the field of the present invention. In Lewis, there is disclosed the multi-domain network manager, which provides alarm correlation among a plurality of domains included in the communications network. Individual network management systems monitor single respective domain of the communications network and provide alarms indicative of status specific to the single respective domain. A multi-domain network manager receives the alarms and correlates them to provide inter-domain alarms as well as responses in the form of corrective actions. The manager provides a high level of correlation and response for the entire network. In this reference, it is solely the multi-domain manager that performs alarm correlation, while the other network entities, such as the network management systems, only function to relay the alarms from the network resources to the manager. Conclusively, Lewis' teaching is limited to a method for correlating alarms within a manager, which again puts the heavy processing burden related to alarm correlation on the manager.